Cybersecurity SOC Lead AI and Automation

Job Description:

Key Responsibilities

• Lead the offshore SOC pod across L1 and L2 activities, ensure queue health, review investigation quality, and maintain strong stakeholder alignment with Clearwater Paper security leadership.
• Own daily operational governance including case quality, severity calibration, shift handoffs, SLA adherence, and escalation discipline for major incidents.
• Drive continuous improvement in Splunk ES / Mission Control operations, detection logic review, alert noise reduction, and visibility gap identification.
• Coordinate across CrowdStrike, Proofpoint, Qualys, Palo Alto, Dragos, ServiceNow, and automation workflows to improve response effectiveness.
• Translate technical events into concise business risk language for U.S. stakeholders and support weekly service reviews, KPI reporting, and corrective action tracking.
• Promote responsible use of AI-assisted summarization, enrichment, and workflow acceleration within approved guardrails.

Tool Environment

Splunk ES / Mission Control, CrowdStrike, Qualys, Proofpoint, Palo Alto, Dragos, ServiceNow, Teams, M365 / Entra context, automation / SOAR capabilities where approved.

Required Experience & Skills

• Strong security operations leadership experience, including direct management of analysts or provider teams in a 24x7 or follow-the-sun model.
• Advanced proficiency in Splunk-based SOC operations and solid working knowledge of endpoint, network, email, and vulnerability telemetry.
• Ability to coach analysts, review investigations, and enforce consistent case quality and operational rigor.
• Strong executive-facing communication and ability to run governance reviews with facts, metrics, and remediation actions.
• Experience working with offshore teams serving U.S.-based stakeholders.

Preferred Qualifications

• Manufacturing / OT security exposure, especially where corporate-to-plant visibility and escalation discipline matter.
• Experience with ServiceNow workflows, playbook optimization, and approved automation / SOAR patterns.
• Awareness of MITRE ATT&CK-aligned detection engineering and risk-based incident prioritization.